St.Vincent Medical Group, Inc.

St. Vincent Medical Group, Inc., the covered entity (CE), reported that on December 3, 2014, it learned that an employee’s user name and password had been compromised as a result of a phishing email attack. This breach affected approximately 756 individuals. The protected health information (PHI) involved in the breach included names, addresses, dates of birth, clinical information, and in some cases, and social security numbers. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE disabled and reset the password for the email account responsible for the breach, and required the employee to reset their password. It also deployed software to scan internet addresses in employees’ emails to determine if they are malicious, and required phishing training for all employees. OCR obtained documented assurances that the CE implemented the corrective action steps listed above.